Methods And Systems For Providing Context-Based Outbound Processing Application Firewalls

ABSTRACT

Outbound processing with application firewalls. An outbound message is generated with an application. The outbound message includes at least a trustworthiness indicator and/or marking information for the one or more portions of the outbound message. The outbound message is received by an application firewall. The outbound message is analyzed based on the trustworthiness indicator and/or marking information, and context information. An action is performed on the outbound message based on the trustworthiness indicator and/or marking information, and the context information.

CLAIM OF PRIORITY

This continuation application claims the benefit of U.S. patentapplication Ser. No. 12/982,769, entitled “METHODS AND SYSTEMS FORPROVIDING CONTEXT-BASED OUTBOUND PROCESSING APPLICATION FIREWALLS”, byYoel Gluck, filed Dec. 30, 2010, and also claims the benefit of U.S.Provisional Patent Application No. 61/358,486 entitled “Methods AndSystems For Providing Context-Based Outbound Processing ApplicationFirewalls”, by Yoel Gluck, filed Jun. 25, 2010, the entire contents ofwhich are incorporated herein by reference.

CROSS REFERENCE TO RELATED APPLICATIONS

The following commonly owned, co-pending United States Patents andPatent Applications, including the present application, are related toeach other. Each of the other patents/applications are incorporated byreference herein in its entirety:

U.S. patent application Ser. No. 12/982,725 entitled “METHODS ANDSYSTEMS FOR CONTEXT-BASED APPLICATION FIREWALLS”, by Yoel Gluck, filedDec. 30, 2010, now U.S. Pat. No. 9,160,710; and

U.S. patent application Ser. No. 14/874,225, entitled “METHODS ANDSYSTEMS FOR CONTEXT-BASED APPLICATION FIREWALLS”, by Yoel Gluck, filedOct. 2, 2015, which is a continuation application of U.S. patentapplication Ser. No. 12/982,725; and

U.S. patent application Ser. No. 12/982,751 entitled “Methods AndSystems For Providing a Token-Based Application Firewall Correlation”,by Yoel Gluck, filed Dec. 30, 2010, now U.S. Pat. No. 9,350,705; and

U.S. patent application Ser. No. 15/159,732 entitled “Methods AndSystems For Providing a Token-Based Application Firewall Correlation”,by Yoel Gluck, filed May 19, 2016, which is a continuation applicationof U.S. patent application Ser. No. 12/982,751.

COPYRIGHT NOTICE

A portion of the disclosure of this patent document contains materialwhich is subject to copyright protection. The copyright owner has noobjection to the facsimile reproduction by anyone of the patent documentor the patent disclosure, as it appears in the Patent and TrademarkOffice patent file or records, but otherwise reserves all copyrightrights whatsoever.

FIELD OF THE INVENTION

Embodiments of the invention relate generally to firewalls and networksecurity. More particularly, embodiments of the invention relate totechniques for providing context-based outbound processing applicationfirewalls.

BACKGROUND

The subject matter discussed in the background section should not beassumed to be prior art merely as a result of its mention in thebackground section. Similarly, a problem mentioned in the backgroundsection or associated with the subject matter of the background sectionshould not be assumed to have been previously recognized in the priorart. The subject matter in the background section merely representsdifferent approaches, which in and of themselves may also be inventions.

Web applications are a big part of applications today. They vary fromsimple web site, travel and booking, enterprise, banking applicationsand many more. Each of these applications has a set of security threatsrelevant to it. These applications tend to have security code integratedin to the application itself, however; because these applications arerelatively large, the surface is too big to cover with a single chokepoint. With the increased complexity comes additional risk forundetected vulnerabilities. This is one of the reasons web applicationssome times use a separate web application firewall system. This allows aseparate code base to use a single choke point and evaluate the entireapplication behavior at run time for potential vulnerabilities.

BRIEF DESCRIPTION OF THE DRAWINGS

In the following drawings like reference numbers are used to refer tolike elements. Although the following figures depict various examples ofthe invention, the invention is not limited to the examples depicted inthe figures.

FIG. 1a is a conceptual diagram of a first configuration in whichoutbound firewall processing may be provided.

FIG. 1b is a conceptual diagram of a second configuration in whichoutbound firewall processing may be provided.

FIG. 2 is a flow diagram of one embodiment of a technique for a firewallto respond to untrusted user input from an application.

FIG. 3 is a flow diagram of one embodiment of a request and response ina system supporting outbound firewall processing.

FIG. 4 is a block diagram of one embodiment of an agent to supportoutbound firewall processing.

FIG. 5 is a block diagram of an environment in which an on-demanddatabase service might be used.

FIG. 6 is a block diagram of one embodiment of a multi-tenantenvironment.

DETAILED DESCRIPTION

As used herein, “application firewall” and/or “firewall” generallyrefers to an application firewall entity that provides a higher-levelanalysis of network traffic (e.g., the application level, layer 5+), forexample, inspecting traffic specific to an application based on thelogic of the application. In contrast, traditional firewalls inspectLayers 3 and 4 and generally do IP- and port-based filtering and logic.Described herein are application firewalls that provide outbound trafficprocessing on messages from one or more applications. The techniquesdescribed herein may be utilized by application firewalls, but may alsobe incorporated into traditional firewalls.

In general, outbound processing is described as being performed by anapplication firewall. In some embodiments this functionality may beperformed exclusively by an application firewall. In other embodimentsoutbound firewall processing can be in the application firewall,application, and/or any other location or stack. By using context datato filter outbound data in an application firewall and protect againstsecurity vulnerabilities, portions of data may be marked for theirsource and/or trustworthiness and then the firewall will use that datain order to filter out potential vulnerabilities. For example, toprotect against XSS, untrusted data may be marked and then the firewallmay ensure that none of the data can be treated as executable orotherwise dangerous data. In one embodiment, the data traffic isoutbound from a multitenant database environment; however, in alternateembodiments, other non-multitenant environments may also utilize thetechniques described herein.

As used herein, the term multitenant database system or multitenantdatabase environment refers to those systems in which various elementsof hardware and software of the database system may be shared by one ormore customers. For example, a given application server maysimultaneously process requests for a great number of customers, and agiven database table may store rows for a potentially much greaternumber of customers.

In one embodiment, a multi-tenant database system utilizes tenantidentifiers (IDs) within a multi-tenant environment to allow individualtenants to access their data while preserving the integrity of othertenant's data. In one embodiment, the multitenant database stores datafor multiple client entities each identified by a tenant ID having oneor more users associated with the tenant ID. Users of each of multipleclient entities can only access data identified by a tenant IDassociated with their respective client entity. In one embodiment, themultitenant database is a hosted database provided by an entity separatefrom the client entities, and provides on-demand and/or real-timedatabase service to the client entities.

In one embodiment, data can be marked by the application for sourceand/or trustworthiness on input from user, or the marking can beaccomplished by other component that is context aware and can providethat information. This can be the application server itself, thefirewall that was provided with that information and handled on requestinput, etc. In one embodiment, data can be marked/encoded differently(e.g., trusted vs. untrusted) at different locations and times. Forexample, data can be marked/encoded as input at the firewall on inputfrom user, then when application receives the request it can create anobject marked as input, but the data can be cleaned/decoded so it iseasier to handle, for example, for search and comparison, then whensaved into local storage, the data itself can be again marked/encoded.

Data can be marked in different ways, for example: each byte can bemarked by encoding the byte in a specific way. Using location basedinformation, for example, a header says that byte range 20-40 in theHTTP data is user input, using boundaries like MIME to separate theportions and identify trusted vs. un-trusted, HTML comments, etc. Otherheader configurations can also be supported, as this is but one example.

In one embodiment, the firewall can use static analysis to discover ifany un-trusted code will be executed at run time, or the firewall canuse a parser to do this. When the firewall identifies code that is to beexecuted without permission, the firewall can react based on policies.For example, if it detects un-trusted code as a Java Script code, thefirewall can insert additional code to be non-executable, escape thedata, or it can block the response, etc.

In some cases it will not be simple to encode real data because of thecomplexity of the systems involved. In such cases, a side channelmonitoring system can be used to actively monitor each request. In oneembodiment, this side channel can use the same real data, store itencoded and then detect encoded user data being injected/used invulnerable locations/ways.

In one implementation we would have the encoded/marked data continue asencoded/marked to the client and have the client enforce the safetyrules. For example, the client will make sure not to execute any userinput data. The client will then be able to decode if needed when safe.

FIG. 1a is a conceptual diagram of a first configuration in whichoutbound firewall processing may be provided. In the example of FIG. 1a, firewall 100 receives request 110 including user data from a remoteuser device (not illustrated in FIG. 1a ). Firewall 100 encodes the userdata based on context information. In one embodiment, the contextinformation may be received from application 120. The contextinformation may also be maintained by firewall 100, or some other systemcomponent. Request 110 with the encoded data is then sent to application120 by firewall 100.

Application 120 operates on request 110 to generate response 140, whichincludes whatever data may be provided by application 120 as well asencoded user data. When firewall 100 receives response 140, firewall 100checks response 140 to determine whether the response is safe based, atleast in part, on the encoded user data and context information such asthe location in the page the user data is included.

FIG. 1b is a conceptual diagram of a second configuration in whichoutbound firewall processing may be provided. In the example of FIG. 1b, firewall 100 receives a request including user data from a remote userdevice (not illustrated in FIG. 1b ). Firewall 100 does not encode theuser data. The request is sent to application 120 by firewall 100.

Application 120 operates on the request to generate response 170, whichincludes whatever data may be provided by application 120 as well asencoded user data. In the example of FIG. 1b , application 120 encodesthe user data based on context information maintained by application120, or some other system component. When firewall 100 receives response170, firewall 100 checks response 170 to determine whether the responseis safe based, at least in part, on the encoded user data and contextinformation such as the location in the page the user data is included.

FIG. 2 is a flow diagram of one embodiment of a technique for a firewallto respond to untrusted user input from an application. Application 210generates a response as described above. Response 220 with user inputmarked as untrusted, 220, is transmitted from application 210 tofirewall 230.

Firewall 230 interacts with data analyzer 240 to analyze response 220and take appropriate action based on the data encoding/markinginformation in response 220. In one embodiment, data analyzer 240 mayoperate in conjunction with, or store data from, application 210. If theuntrusted user input seems to be located in such a way that if sent tothe user it will not be executed, 250, then response 220 is forwarded asis, 260. If the untrusted user input will be executed, 250, thenresponse 220 is redirected to allow a safe response, 270. In addition orinstead of redirection, the firewall can perform other actions such as:alert an administrator, output escape the untrusted user data based onthe context information, etc.

FIG. 3 is a flow diagram of one embodiment of a request and response ina system supporting outbound firewall processing. The functionalitydescribed with respect to FIG. 3 may be provided by a firewall and/or anapplication as described above with respect to FIGS. 1 and 2.

The request message is received from a remote device, 310. In oneembodiment, the request message is received by a firewall within amultitenant environment. Embodiments of multitenant environments aredescribed in greater detail below. In other embodiments, the requestmessage may be received by a firewall of an intranet or otherconfiguration of computing resources that may provide a response to therequest message.

Any inbound firewall processing that may be performed is performed bythe firewall, 320. In one embodiment, the firewall may also mark/encodedata in the request message. The encoding may be based on, for example,context information provided by the application, or by some other entitywithin the system. The context information may be related to user,client entity, session, field type, location of output in the page,browser/application type, rendering systems, etc. In one embodiment, theapplication may also use the mark/encoding information and/or performproper actions, not just the firewall. That is, the functionalitydescribed for the firewall may be provided by the firewall, application,or any other location/stack.

The firewall forwards the request message to the application. Theapplication receives the request message and processes it, 330.Depending on the contents of the request message, the application mayperform, or cause to be performed, various functions in order togenerate a response message, 340. During this processing, theapplication may gather and/or update context information. This contextinformation may be forwarded to the firewall. When the applicationgenerates the response message, it is forwarded from the application tothe firewall.

The firewall performs outbound processing on the response message, 350.The outbound firewall processing may be performed as described herein.In one embodiment, the firewall utilizes context information provided byat least the application. Context information may be provided by othersystem components as well. In one embodiment, the firewall may becoupled with (or include) a data analyzer (e.g., 240 in FIG. 2) that maymanage the context information.

The outbound firewall processing may include various operationsdiscussed herein. The outbound processing may include, for example,rerouting of the response message, tagging the response message,dropping a portion of the response message, modifying a portion of theresponse message, and/or any other application firewall operation thatmay be performed on inbound/outbound traffic. After the outboundfirewall processing, the response message may be transmitted to theremote device from which the request message was received, 360.

FIG. 4 is a block diagram of one embodiment of an agent to supportoutbound firewall processing. The components illustrated in FIG. 4 maybe part of a firewall, an application, and/or any combination thereof.Further, the firewall and/or the application may be part of amultitenant database environment.

Outbound traffic agent 400 includes control logic 410, which implementslogical functional control to direct operation of outbound traffic agent400, and/or hardware associated with directing operation of outboundtraffic agent 400. Logic may be hardware logic circuits and/or softwareroutines. In one embodiment, outbound traffic agent 400 includes one ormore applications 412, which represent code sequence and/or programsthat provide instructions to control logic 410.

Outbound traffic agent 400 includes memory 414, which represents amemory device and/or access to a memory resource for storing data and/orinstructions. Memory 414 may include memory local to outbound trafficagent 400, as well as, or alternatively, including memory of the hostsystem on which outbound traffic agent 400 resides. Outbound trafficagent 400 also includes one or more interfaces 416, which representaccess interfaces to/from (an input/output interface) outbound trafficagent 400 with regard to entities (electronic or human) external tooutbound traffic agent 400.

Outbound traffic agent 400 also includes outbound traffic engine 420,which represents one or more functions or module that enable outboundtraffic agent 400 to provide the security services as described above.The example of FIG. 4 provides several modules that may be included inoutbound traffic engine 420; however, different and/or additionalmodules may also be included. Example modules that may be involved inproviding the outbound firewall functionality include firewallinterface(s) 430, application interface(s) 440, traffic analysis module450, context management module 460 and actions module 470. Each of thesemodules may further include other sub-modules to provide otherfunctions. As used herein, a module refers to routine, a subsystem,logic circuit, microcode, etc., whether implemented in hardware,software, firmware or some combination thereof.

Firewall interface(s) 430 provides interface(s) between outbound trafficengine 420 and one or more firewalls. Firewall interface(s) 430 may behardware interfaces (e.g., Ethernet, USB) and/or software interfaces(e.g., APIs). Similarly, application interface(s) 440 provideinterface(s) between outbound traffic engine 420 and one or moreapplications. Application interface(s) 440 may be hardware interfaces(e.g., Ethernet, USB) and/or software interfaces (e.g., APIs).

Traffic analysis module 450 provides the firewall operations describedherein. Traffic analysis module 450 may also interact with actionsmodule 470 to cause the response message to be redirected, if necessary.Context management module 460 operates to maintain and store contextinformation received from one or more applications/firewalls and othersystems that may be used for outbound firewall operations.

System Overview

FIG. 5 illustrates a block diagram of an environment 510 wherein anon-demand database service might be used. Environment 510 may includeuser systems 512, network 514, system 516, processor system 517,application platform 518, network interface 520, tenant data storage522, system data storage 524, program code 526, and process space 528.In other embodiments, environment 510 may not have all of the componentslisted and/or may have other elements instead of, or in addition to,those listed above.

Environment 510 is an environment in which an on-demand database serviceexists. User system 512 may be any machine or system that is used by auser to access a database user system. For example, any of user systems512 can be a handheld computing device, a mobile phone, a laptopcomputer, a work station, and/or a network of computing devices. Asillustrated in FIG. 5 (and in more detail in FIG. 6) user systems 512might interact via a network 514 with an on-demand database service,which is system 516.

An on-demand database service, such as system 516, is a database systemthat is made available to outside users that do not need to necessarilybe concerned with building and/or maintaining the database system, butinstead may be available for their use when the users need the databasesystem (e.g., on the demand of the users). In one embodiment, system 516includes firewall 530 that provides the firewall functionality asdescribed herein. Some on-demand database services may store informationfrom one or more tenants stored into tables of a common database imageto form a multi-tenant database system (MTS). Accordingly, “on-demanddatabase service 516” and “system 516” will be used interchangeablyherein.

A database image may include one or more database objects. A relationaldatabase management system (RDMS) or the equivalent may execute storageand retrieval of information against the database object(s). Applicationplatform 518 may be a framework that allows the applications of system516 to run, such as the hardware and/or software, e.g., the operatingsystem. In an embodiment, on-demand database service 516 may include anapplication platform 518 that enables creation, managing and executingone or more applications developed by the provider of the on-demanddatabase service, users accessing the on-demand database service viauser systems 512, or third party application developers accessing theon-demand database service via user systems 512.

The users of user systems 512 may differ in their respective capacities,and the capacity of a particular user system 512 might be entirelydetermined by permissions (permission levels) for the current user. Forexample, where a salesperson is using a particular user system 512 tointeract with system 516, that user system has the capacities allottedto that salesperson. However, while an administrator is using that usersystem to interact with system 516, that user system has the capacitiesallotted to that administrator. In systems with a hierarchical rolemodel, users at one permission level may have access to applications,data, and database information accessible by a lower permission leveluser, but may not have access to certain applications, databaseinformation, and data accessible by a user at a higher permission level.Thus, different users will have different capabilities with regard toaccessing and modifying application and database information, dependingon a user's security or permission level.

Network 514 is any network or combination of networks of devices thatcommunicate with one another. For example, network 514 can be any one orany combination of a LAN (local area network), WAN (wide area network),telephone network, wireless network, point-to-point network, starnetwork, token ring network, hub network, or other appropriateconfiguration. As the most common type of computer network in currentuse is a TCP/IP (Transfer Control Protocol and Internet Protocol)network, such as the global internetwork of networks often referred toas the “Internet” with a capital “I,” that network will be used in manyof the examples herein. However, it should be understood that thenetworks that the present invention might use are not so limited,although TCP/IP is a frequently implemented protocol.

User systems 512 might communicate with system 516 using TCP/IP and, ata higher network level, use other common Internet protocols tocommunicate, such as HTTP, FTP, AFS, WAP, etc. In an example where HTTPis used, user system 512 might include an HTTP client commonly referredto as a “browser” for sending and receiving HTTP messages to and from anHTTP server at system 516. Such an HTTP server might be implemented asthe sole network interface between system 516 and network 514, but othertechniques might be used as well or instead. In some implementations,the interface between system 516 and network 514 includes load sharingfunctionality, such as round-robin HTTP request distributors to balanceloads and distribute incoming HTTP requests evenly over a plurality ofservers. At least as for the users that are accessing that server, eachof the plurality of servers has access to the MTS' data; however, otheralternative configurations may be used instead.

In one embodiment, system 516, shown in FIG. 5, implements a web-basedcustomer relationship management (CRM) system. For example, in oneembodiment, system 516 includes application servers configured toimplement and execute CRM software applications as well as providerelated data, code, forms, webpages and other information to and fromuser systems 512 and to store to, and retrieve from, a database systemrelated data, objects, and Webpage content. With a multi-tenant system,data for multiple tenants may be stored in the same physical databaseobject, however, tenant data typically is arranged so that data of onetenant is kept logically separate from that of other tenants so that onetenant does not have access to another tenant's data, unless such datais expressly shared.

In certain embodiments, system 516 implements applications other than,or in addition to, a CRM application. For example, system 516 mayprovide tenant access to multiple hosted (standard and custom)applications, including a CRM application. User (or third partydeveloper) applications, which may or may not include CRM, may besupported by the application platform 518, which manages creation,storage of the applications into one or more database objects andexecuting of the applications in a virtual machine in the process spaceof the system 516.

One arrangement for elements of system 516 is shown in FIG. 5, includinga network interface 520, application platform 518, tenant data storage522 for tenant data 523, system data storage 524 for system data 525accessible to system 516 and possibly multiple tenants, program code 526for implementing various functions of system 516, and a process space528 for executing MTS system processes and tenant-specific processes,such as running applications as part of an application hosting service.Additional processes that may execute on system 516 include databaseindexing processes.

Several elements in the system shown in FIG. 5 include conventional,well-known elements that are explained only briefly here. For example,each user system 512 could include a desktop personal computer,workstation, laptop, PDA, cell phone, or any wireless access protocol(WAP) enabled device or any other computing device capable ofinterfacing directly or indirectly to the Internet or other networkconnection. User system 512 typically runs an HTTP client, e.g., abrowsing program, such as Microsoft's Internet Explorer browser,Netscape's Navigator browser, Opera's browser, or a WAP-enabled browserin the case of a cell phone, PDA or other wireless device, or the like,allowing a user (e.g., subscriber of the multi-tenant database system)of user system 512 to access, process and view information, pages andapplications available to it from system 516 over network 514.

Each user system 512 also typically includes one or more user interfacedevices, such as a keyboard, a mouse, trackball, touch pad, touchscreen, pen or the like, for interacting with a graphical user interface(GUI) provided by the browser on a display (e.g., a monitor screen, LCDdisplay, etc.) in conjunction with pages, forms, applications and otherinformation provided by system 516 or other systems or servers. Forexample, the user interface device can be used to access data andapplications hosted by system 516, and to perform searches on storeddata, and otherwise allow a user to interact with various GUI pages thatmay be presented to a user. As discussed above, embodiments are suitablefor use with the Internet, which refers to a specific globalinternetwork of networks. However, it should be understood that othernetworks can be used instead of the Internet, such as an intranet, anextranet, a virtual private network (VPN), a non-TCP/IP based network,any LAN or WAN or the like.

According to one embodiment, each user system 512 and all of itscomponents are operator configurable using applications, such as abrowser, including computer code run using a central processing unitsuch as an Intel Pentium® processor or the like. Similarly, system 516(and additional instances of an MTS, where more than one is present) andall of their components might be operator configurable usingapplication(s) including computer code to run using a central processingunit such as processor system 517, which may include an Intel Pentium®processor or the like, and/or multiple processor units.

A computer program product embodiment includes a machine-readablestorage medium (media) having instructions stored thereon/in which canbe used to program a computer to perform any of the processes of theembodiments described herein. Computer code for operating andconfiguring system 516 to intercommunicate and to process webpages,applications and other data and media content as described herein arepreferably downloaded and stored on a hard disk, but the entire programcode, or portions thereof, may also be stored in any other volatile ornon-volatile memory medium or device as is well known, such as a ROM orRAM, or provided on any media capable of storing program code, such asany type of rotating media including floppy disks, optical discs,digital versatile disk (DVD), compact disk (CD), microdrive, andmagneto-optical disks, and magnetic or optical cards, nanosystems(including molecular memory ICs), or any type of media or devicesuitable for storing instructions and/or data.

Additionally, the entire program code, or portions thereof, may betransmitted and downloaded from a software source over a transmissionmedium, e.g., over the Internet, or from another server, as is wellknown, or transmitted over any other conventional network connection asis well known (e.g., extranet, VPN, LAN, etc.) using any communicationmedium and protocols (e.g., TCP/IP, HTTP, HTTPS, Ethernet, etc.) as arewell known. It will also be appreciated that computer code forimplementing embodiments of the present invention can be implemented inany programming language that can be executed on a client system and/orserver or server system such as, for example, C, C++, HTML, any othermarkup language, Java™ JavaScript, ActiveX, any other scriptinglanguage, such as VBScript, and many other programming languages as arewell known may be used. (Java™ is a trademark of Sun Microsystems,Inc.).

According to one embodiment, each system 516 is configured to provideweb pages, forms, applications, data and media content to user (client)systems 512 to support the access by user systems 512 as tenants ofsystem 516. As such, system 516 provides security mechanisms to keepeach tenant's data separate unless the data is shared. If more than oneMTS is used, they may be located in close proximity to one another(e.g., in a server farm located in a single building or campus), or theymay be distributed at locations remote from one another (e.g., one ormore servers located in city A and one or more servers located in cityB). As used herein, each MTS could include one or more logically and/orphysically connected servers distributed locally or across one or moregeographic locations.

Additionally, the term “server” is meant to include a computer system,including processing hardware and process space(s), and an associatedstorage system and database application (e.g., OODBMS or RDBMS) as iswell known in the art. It should also be understood that “server system”and “server” are often used interchangeably herein. Similarly, thedatabase object described herein can be implemented as single databases,a distributed database, a collection of distributed databases, adatabase with redundant online or offline backups or other redundancies,etc., and might include a distributed database or storage network andassociated processing intelligence.

FIG. 6 also illustrates environment 510. However, in FIG. 6 elements ofsystem 516 and various interconnections in an embodiment are furtherillustrated. FIG. 6 shows that user system 512 may include processorsystem 512A, memory system 512B, input system 512C, and output system512D. FIG. 6 shows network 514 and system 516. FIG. 6 also shows thatsystem 516 may include tenant data storage 522, tenant data 523, systemdata storage 524, system data 525, User Interface (UI) 630, ApplicationProgram Interface (API) 632, PL/SOQL 634, save routines 636, applicationsetup mechanism 638, applications servers 6001-600N, system processspace 602, tenant process spaces 604, tenant management process space610, tenant storage area 612, user storage 614, and application metadata616. In other embodiments, environment 510 may not have the sameelements as those listed above and/or may have other elements insteadof, or in addition to, those listed above.

User system 512, network 514, system 516, tenant data storage 522, andsystem data storage 524 were discussed above in FIG. 5. Regarding usersystem 512, processor system 512A may be any combination of one or moreprocessors. Memory system 512B may be any combination of one or morememory devices, short term, and/or long term memory. Input system 512Cmay be any combination of input devices, such as one or more keyboards,mice, trackballs, scanners, cameras, and/or interfaces to networks.Output system 512D may be any combination of output devices, such as oneor more monitors, printers, and/or interfaces to networks. As shown byFIG. 6, system 516 may include a network interface 520 (of FIG. 5)implemented as a set of HTTP application servers 600, an applicationplatform 518, tenant data storage 522, and system data storage 524.

Also shown is system process space 602, including individual tenantprocess spaces 604 and a tenant management process space 610. Eachapplication server 600 may be configured to tenant data storage 522 andthe tenant data 523 therein, and system data storage 524 and the systemdata 525 therein to serve requests of user systems 512. The tenant data523 might be divided into individual tenant storage areas 612, which canbe either a physical arrangement and/or a logical arrangement of data.Within each tenant storage area 612, user storage 614 and applicationmetadata 616 might be similarly allocated for each user. For example, acopy of a user's most recently used (MRU) items might be stored to userstorage 614. Similarly, a copy of MRU items for an entire organizationthat is a tenant might be stored to tenant storage area 612. A UI 630provides a user interface and an API 632 provides an applicationprogrammer interface to system 516 resident processes to users and/ordevelopers at user systems 512. The tenant data and the system data maybe stored in various databases, such as one or more Oracle′ databases.

Application platform 518 includes an application setup mechanism 638that supports application developers' creation and management ofapplications, which may be saved as metadata into tenant data storage522 by save routines 636 for execution by subscribers as one or moretenant process spaces 604 managed by tenant management process 610 forexample. Invocations to such applications may be coded using PL/SOQL 634that provides a programming language style interface extension to API632.

A detailed description of some PL/SOQL language embodiments is discussedin commonly owned co-pending U.S. Provisional Patent Application60/828,192 entitled, PROGRAMMING LANGUAGE METHOD AND SYSTEM FOREXTENDING APIS TO EXECUTE IN CONJUNCTION WITH DATABASE APIS, by CraigWeissman, filed Oct. 4, 2006, which is incorporated in its entiretyherein for all purposes. Invocations to applications may be detected byone or more system processes, which manages retrieving applicationmetadata 616 for the subscriber making the invocation and executing themetadata as an application in a virtual machine.

Each application server 600 may be communicably coupled to databasesystems, e.g., having access to system data 525 and tenant data 523, viaa different network connection. For example, one application server 600i might be coupled via the network 514 (e.g., the Internet), anotherapplication server 600N-1 might be coupled via a direct network link,and another application server 600N might be coupled by yet a differentnetwork connection. Transfer Control Protocol and Internet Protocol(TCP/IP) are typical protocols for communicating between applicationservers 600 and the database system. However, it will be apparent to oneskilled in the art that other transport protocols may be used tooptimize the system depending on the network interconnect used.

In certain embodiments, each application server 600 is configured tohandle requests for any user associated with any organization that is atenant. Because it is desirable to be able to add and remove applicationservers from the server pool at any time for any reason, there ispreferably no server affinity for a user and/or organization to aspecific application server 600. In one embodiment, therefore, aninterface system implementing a load balancing function (e.g., an F5Big-IP load balancer) is communicably coupled between the applicationservers 600 and the user systems 512 to distribute requests to theapplication servers 600.

In one embodiment, the load balancer uses a least connections algorithmto route user requests to the application servers 600. Other examples ofload balancing algorithms, such as round robin and observed responsetime, also can be used. For example, in certain embodiments, threeconsecutive requests from the same user could hit three differentapplication servers 600, and three requests from different users couldhit the same application server 600. In this manner, system 516 ismulti-tenant, wherein system 516 handles storage of, and access to,different objects, data and applications across disparate users andorganizations.

As an example of storage, one tenant might be a company that employs asales force where each salesperson uses system 516 to manage their salesprocess. Thus, a user might maintain contact data, leads data, customerfollow-up data, performance data, goals and progress data, etc., allapplicable to that user's personal sales process (e.g., in tenant datastorage 522). In an example of a MTS arrangement, since all of the dataand the applications to access, view, modify, report, transmit,calculate, etc., can be maintained and accessed by a user system havingnothing more than network access, the user can manage his or her salesefforts and cycles from any of many different user systems. For example,if a salesperson is visiting a customer and the customer has Internetaccess in their lobby, the salesperson can obtain critical updates as tothat customer while waiting for the customer to arrive in the lobby.

While each user's data might be separate from other users' dataregardless of the employers of each user, some data might beorganization-wide data shared or accessible by a plurality of users orall of the users for a given organization that is a tenant. Thus, theremight be some data structures managed by system 516 that are allocatedat the tenant level while other data structures might be managed at theuser level. Because an MTS might support multiple tenants includingpossible competitors, the MTS should have security protocols that keepdata, applications, and application use separate. Also, because manytenants may opt for access to an MTS rather than maintain their ownsystem, redundancy, up-time, and backup are additional functions thatmay be implemented in the MTS. In addition to user-specific data andtenant specific data, system 516 might also maintain system level datausable by multiple tenants or other data. Such system level data mightinclude industry reports, news, postings, and the like that are sharableamong tenants.

In certain embodiments, user systems 512 (which may be client systems)communicate with application servers 600 to request and updatesystem-level and tenant-level data from system 516 that may requiresending one or more queries to tenant data storage 522 and/or systemdata storage 524. System 516 (e.g., an application server 600 in system516) automatically generates one or more SQL statements (e.g., one ormore SQL queries) that are designed to access the desired information.System data storage 524 may generate query plans to access the requesteddata from the database.

Each database can generally be viewed as a collection of objects, suchas a set of logical tables, containing data fitted into predefinedcategories. A “table” is one representation of a data object, and may beused herein to simplify the conceptual description of objects and customobjects according to the present invention. It should be understood that“table” and “object” may be used interchangeably herein. Each tablegenerally contains one or more data categories logically arranged ascolumns or fields in a viewable schema. Each row or record of a tablecontains an instance of data for each category defined by the fields.

For example, a CRM database may include a table that describes acustomer with fields for basic contact information such as name,address, phone number, fax number, etc. Another table might describe apurchase order, including fields for information such as customer,product, sale price, date, etc. In some multi-tenant database systems,standard entity tables might be provided for use by all tenants. For CRMdatabase applications, such standard entities might include tables forAccount, Contact, Lead, and Opportunity data, each containingpre-defined fields. It should be understood that the word “entity” mayalso be used interchangeably herein with “object” and “table”.

CONCLUSION

In some multi-tenant database systems, tenants may be allowed to createand store custom objects, or they may be allowed to customize standardentities or objects, for example by creating custom fields for standardobjects, including custom index fields. U.S. patent application Ser. No.10/817,161, filed Apr. 2, 2004, entitled “Custom Entities and Fields ina Multi-Tenant Database System”, and which is hereby incorporated hereinby reference, teaches systems and methods for creating custom objects aswell as customizing standard objects in a multi-tenant database system.In certain embodiments, for example, all custom entity data rows arestored in a single multi-tenant physical table, which may containmultiple logical tables per organization. It is transparent to customersthat their multiple “tables” are in fact stored in one large table orthat their data may be stored in the same table as the data of othercustomers.

Reference in the specification to “one embodiment” or “an embodiment”means that a particular feature, structure, or characteristic describedin connection with the embodiment is included in at least one embodimentof the invention. The appearances of the phrase “in one embodiment” invarious places in the specification are not necessarily all referring tothe same embodiment.

While the invention has been described by way of example and in terms ofthe specific embodiments, it is to be understood that the invention isnot limited to the disclosed embodiments. To the contrary, it isintended to cover various modifications and similar arrangements aswould be apparent to those skilled in the art. Therefore, the scope ofthe appended claims should be accorded the broadest interpretation so asto encompass all such modifications and similar arrangements.

What is claimed is:
 1. A method comprising: receiving the outboundmessage from an application executing on a hardware computing devicewith an application-level firewall, wherein the outbound messageincludes at least a trustworthiness indicator and marking informationbased on inbound processing at the application-level firewall for theone or more portions of the outbound message, wherein the outboundmessage is to be transmitted to a remote electronic device; analyzingthe outbound message based on the trustworthiness indicator and/ormarking information, and context information with the application-levelfirewall; and performing an action on traffic to the application basedon the encoded user data and the context information with one of theapplication-level firewall and the application by forwarding withoutmodification when the outbound message is to be considered safe and tonot forwarding the traffic when the outbound message is to be consideredunsafe.
 2. The method of claim 1 further comprising encoding theoutbound message with the application firewall based on thetrustworthiness indicator before passing the outbound message.
 3. Themethod of claim 1 wherein the action comprises marking data asunexecutable.
 4. The method of claim 1 wherein the action comprisesencoding data based on the context information to render the data safelyon the user device.
 5. The method of claim 1 wherein the actioncomprises forwarding the response message to the remote user device. 6.The method of claim 1 wherein the action comprises redirecting theresponse message.
 7. The method of claim 5 wherein the outbound messageis redirected to a designated safe URL.
 8. The method of claim 1 whereinthe host system comprises a multitenant database environment, whereinthe multitenant database environment stores data for multiple cliententities each identified by a tenant identifier (ID) having one or moreusers associated with the tenant ID, wherein users of each of multipleclient entities can only access data identified by a tenant IDassociated with the respective client entity, and wherein themultitenant database is a hosted database provided by an entity separatefrom the client entities, and provides on-demand database service to theclient entities.
 9. An article comprising a computer-readable mediumhaving stored thereon instructions that, when executed by one or moreprocessors, are configurable to cause the one or more processors to:receive the outbound message from an application executing on a hardwarecomputing device with an application-level firewall, wherein theoutbound message includes at least a trustworthiness indicator andmarking information based on inbound processing at the application-levelfirewall for the one or more portions of the outbound message, whereinthe outbound message is to be transmitted to a remote electronic device;analyze the outbound message based on the trustworthiness indicatorand/or marking information, and context information with theapplication-level firewall; and perform an action on traffic to theapplication based on the encoded user data and the context informationwith one of the application-level firewall and the application byforwarding without modification when the outbound message is to beconsidered safe and to not forwarding the traffic when the outboundmessage is to be considered unsafe.
 10. The article of claim 9 furthercomprising instructions that, when executed by the one or moreprocessors, cause the one or more processors to encode the outboundmessage with the application firewall based on the trustworthinessindicator before passing the outbound message.
 11. The article of claim9 wherein the action comprises marking data as unexecutable.
 12. Thearticle of claim 9 wherein the action comprises forwarding the responsemessage to the remote user device.
 13. The article of claim 9 whereinthe action comprises redirecting the response message.
 14. The articleof claim 13 wherein the response message is redirected to a designatedsafe URL.
 15. The article of claim 9 wherein the host system comprises amultitenant database environment, wherein the multitenant databaseenvironment stores data for multiple client entities each identified bya tenant identifier (ID) having one or more users associated with thetenant ID, wherein users of each of multiple client entities can onlyaccess data identified by a tenant ID associated with the respectiveclient entity, and wherein the multitenant database is a hosted databaseprovided by an entity separate from the client entities, and provideson-demand database service to the client entities.
 16. A systemcomprising: at least one hardware computing device executing anapplication-level firewall, the server system to provide a multitenantenvironment, wherein the multitenant environment includes data formultiple client entities, each identified by a tenant identifier (ID)having one or more users associated with the tenant ID, users of each ofmultiple client identities can only access data identified by a tenantID associated with the respective client entity, and the multitenantenvironment is at least a hosted database provided by an entity separatefrom the client entities, and provides on-demand database service to theclient entities, the server system further to receive the outboundmessage from an application executing on a hardware computing devicewith an application-level firewall, wherein the outbound messageincludes at least a trustworthiness indicator and marking informationbased on inbound processing at the application-level firewall for theone or more portions of the outbound message, wherein the outboundmessage is to be transmitted to a remote electronic device, to analyzethe outbound message based on the trustworthiness indicator and/ormarking information, and context information with the application-levelfirewall, and to perform an action on traffic to the application basedon the encoded user data and the context information with one of theapplication-level firewall and the application by forwarding withoutmodification when the outbound message is to be considered safe and tonot forwarding the traffic when the outbound message is to be consideredunsafe.
 17. The system of claim 16, wherein the application firewall toencode the request message based on the context information beforepassing the request message to the application.
 18. The system of claim16 wherein the action comprises marking data as unexecutable.
 19. Thesystem of claim 16 wherein the action comprises forwarding the responsemessage to the remote user device.
 20. The system of claim 16 whereinthe action comprises redirecting the response message.
 21. The system ofclaim 20 wherein the response message is redirected to a designated safeURL.